Email marketing compliance: CAN-SPAM, CASL, and GDPR

Every marketing email you send is governed by the laws of the country your recipient lives in, not just where your business is based. If your list includes people in the U.S., Canada, the EU or the UK, you need to understand CAN-SPAM, CASL, GDPR and the e-privacy rules that sit alongside it.

Breaking these laws is one of the most expensive mistakes you can make in email marketing. This guide covers what each law requires as of 2026 and the practical steps that keep you compliant.

The laws at a glance

CAN-SPAM in the United States

The CAN-SPAM Act (Controlling the Assault of Non-Solicited Pornography and Marketing Act) covers all commercial email sent to U.S. recipients, including B2B email. It's enforced by the Federal Trade Commission (FTC).

CAN-SPAM doesn't require consent before you send. Instead, it requires honesty and an easy way out. According to the FTC's compliance guide, every commercial email must:

Each separate email that violates the law can cost up to $53,088. The FTC kept its civil penalty amounts at 2025 levels for 2026.

Transactional emails are mostly exempt

Messages whose primary purpose is transactional or relationship-based, such as receipts, shipping updates, account changes and warranty notices, are exempt from most CAN-SPAM rules. They still can't contain false or misleading routing information. If a transactional email leads with promotional content or a promotional subject line, the FTC treats it as commercial.

CASL in Canada

Canada's Anti-Spam Legislation (CASL) is much stricter than CAN-SPAM. It applies to any commercial electronic message sent to or accessed from a computer in Canada, including email and text messages. The CRTC says every message needs three things: consent, identification and a working unsubscribe mechanism.

Express vs. implied consent under CASL

Pre-checked boxes don't count as express consent, and you must be able to prove consent if challenged. The CRTC also notes that an abandoned shopping cart isn't a purchase, so ask for express consent at checkout.

Your identification details and unsubscribe link must stay valid for at least 60 days after you send, and unsubscribe requests must be processed within 10 business days. Penalties reach up to $1 million per violation for individuals and $10 million per violation for businesses, and directors and officers can be held personally liable.

GDPR and ePrivacy in the European Union

The General Data Protection Regulation (GDPR) has applied since May 2018 to any business that processes the personal data of people in the EU, wherever the business is located.

A common misconception is that GDPR alone requires consent for every marketing email. In practice, two laws work together:

• The ePrivacy Directive (Directive 2002/58/EC, implemented in each member state's law) sets the rule for marketing email itself: you need prior consent, with a "soft opt-in" exception for existing customers buying similar products, as long as you offered an opt-out when you collected their details and in every message.
• GDPR governs how you handle the personal data behind your list. Where you rely on consent, it must be freely given, specific, informed and unambiguous, and you must be able to prove it.

GDPR also gives people strong rights. Under Article 21, anyone can object to direct marketing at any time, and you must stop. People can also request a copy of their data, generally within one month. Fines for the most serious violations reach €20 million or 4% of global annual turnover, whichever is higher.

The UK: PECR and the Data (Use and Access) Act

Since Brexit, the UK has its own rules. Marketing email is governed by the Privacy and Electronic Communications Regulations (PECR) alongside UK GDPR. Per the ICO, you need consent to email individuals and sole traders, unless the soft opt-in applies. You can email corporate addresses without consent, but you must still identify yourself and offer an opt-out.

The Data (Use and Access) Act 2025 raised the maximum PECR fine from £500,000 to £17.5 million or 4% of global turnover, in line with UK GDPR. Most of the Act's data protection provisions came into force on February 5, 2026. The Act also extends the soft opt-in to charities' fundraising messages.

How the laws compare

CAN-SPAM and CASL are prescriptive: they list specific things every message must include. GDPR is principle-based and focuses on the rights of individuals, which makes it broader. If you follow the strictest rules (express consent, clear identification, a simple unsubscribe and good records), you'll be in a strong position everywhere.

Mailbox provider rules add another layer

Beyond the law, the major inbox providers set their own requirements. Under Gmail's sender guidelines, bulk senders (5,000+ messages a day) must support one-click unsubscribe through a List-Unsubscribe header and process unsubscribes within two days, much faster than the legal deadlines. Yahoo has similar rules, and Microsoft now rejects bulk mail that fails authentication. See our guide to the Gmail and Yahoo inbox protection rules.

6 ways to keep your email marketing compliant

1. Get opt-in consent and keep records

Even where the law doesn't require it, permission-based lists perform better and protect your sender reputation. Collect sign-ups through web forms and popups with clear language about what people will receive. Use double opt-in for website forms, and record when, where and how each person subscribed. Learn more in What is an opt-in email?

Never buy lists or scrape addresses from websites and social media. Instead, use these strategies to capture more email leads.

2. Be clear about who you are

Your From name, From address and Reply-To must accurately identify your business. Send from your own authenticated business domain, not a free address like @gmail.com. Misleading sender details can break the law and get your mail flagged as email spoofing. For extra trust in Gmail, consider a Google verified checkmark.

3. Write honest subject lines

Your subject line must reflect what's inside. A misleading subject line may earn an open, but it breaks CAN-SPAM, damages trust and rarely earns the click that matters.

4. Separate promotional and transactional messages

Make it clear when an email is an advertisement, and keep transactional messages focused on the transaction. If you include a promotion in a receipt or shipping notice, keep the transactional content first.

5. Include your physical address

Put a valid postal address in every marketing email footer. Under CAN-SPAM, a P.O. box registered with the USPS or a private mailbox registered with a commercial mail receiving agency works, which is useful if you don't want to publish a home address.

6. Make unsubscribing easy and honor it fast

Use a clear, visible unsubscribe link written in plain language. Don't hide it with tiny or low-contrast text, and don't require a login. The legal deadline is 10 business days in the U.S. and Canada, but Gmail expects two days from bulk senders. DailyStory processes unsubscribe requests immediately, but it's still good practice to confirm opt-outs are being honored.

Keep the experience friendly. People who leave on good terms sometimes come back.

Email compliance checklist

Frequently asked questions

In conclusion

Whether you manage email yourself or work with an in-house or outsourced team, your business is responsible for compliance. Build on consent, be honest about who you are and what you're sending, and make leaving easy. Those habits keep you on the right side of the law and help your emails earn more clicks.

For more, see our 16 email marketing best practices, or request a demo to see how DailyStory manages opt-ins and unsubscribes.